Add file manager and tool tester UI to mcpproxy frontend

[BillJr99]

Summary

This PR adds two new interactive features to the mcpproxy UI: a file manager for browsing/uploading files to volume-mounted directories, and a tool tester for invoking registered MCP tools with custom arguments.

Key Changes

File Manager (/api/files endpoints)

• New REST API endpoints for file operations:

  • GET /api/files — list directory contents with metadata (type, size, mtime)
  • POST /api/files/mkdir — create nested directories
  • POST /api/files/upload — multipart file upload with size limits
  • GET /api/files/download — download files
  • DELETE /api/files — delete files/directories with optional recursive flag

• Security: Implemented _resolve_in_root() helper that validates all paths using Path.resolve() and relative_to() to prevent directory traversal attacks and symlink escapes. Symlinks are detected and listed but cannot be followed for reads.

• Configuration: Added file_roots parameter to create_app() to define whitelisted root directories (tools, files, repos). Defaults to CONFIG_DIR, FILES_DIR, and REPOS_DIR.

• Upload limits: Configurable via MCPPROXY_MAX_UPLOAD_BYTES environment variable (default 50 MB). Partial uploads are cleaned up on failure.

Tool Tester UI

• New modal interface for discovering and invoking registered MCP tools
• Dynamic form generation from tool JSON schemas with support for:
  • Required/optional field indicators
  • Type-specific inputs (text, number, boolean, enum, JSON)
  • Default values and descriptions
• Result rendering with error/success indicators and formatted output display
• Tool filtering by name with provider-based grouping (e.g., provider__tool)

Frontend UI Updates

• Added two new navbar buttons: "📁 Files" and "🧪 Test Tools"
• Implemented file browser with breadcrumb navigation, directory listing, and delegated click handlers
• Added modal dialogs for both features with responsive layouts
• Integrated with existing toast notifications and modal management

Dependencies

• Added python-multipart for FastAPI multipart form handling

Implementation Details

• File paths are always relative to whitelisted roots and validated before any filesystem operation
• Symlinks are safely handled: listed as symlinks but cannot be read through; the link itself can be deleted
• Upload handler streams chunks to prevent memory exhaustion and validates size limits incrementally
• Tool tester collects form arguments with type coercion (integers, JSON parsing) and proper error handling
• All untrusted output (tool results, filenames) is escaped or rendered as text content to prevent XSS

https://claude.ai/code/session_01WnK1rtXGHDCNpsycAvxFqC